================================================================== BUG: KASAN: stack-out-of-bounds in iterate_bvec include/linux/iov_iter.h:116 [inline] BUG: KASAN: stack-out-of-bounds in __copy_from_iter_mc+0x30a/0x3f0 lib/iov_iter.c:262 Read of size 4 at addr ffffc90004d8f594 by task syz-executor.0/5251 CPU: 0 PID: 5251 Comm: syz-executor.0 Not tainted 6.6.0-rc3-next-20230929-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 iterate_bvec include/linux/iov_iter.h:116 [inline] __copy_from_iter_mc+0x30a/0x3f0 lib/iov_iter.c:262 __copy_from_iter lib/iov_iter.c:271 [inline] copy_page_from_iter_atomic+0x471/0x11e0 lib/iov_iter.c:504 generic_perform_write+0x2e9/0x600 mm/filemap.c:3964 ext4_buffered_write_iter+0x11f/0x3c0 fs/ext4/file.c:299 ext4_file_write_iter+0x7f7/0x1860 fs/ext4/file.c:717 __kernel_write_iter+0x261/0x7e0 fs/read_write.c:517 dump_emit_page fs/coredump.c:888 [inline] dump_user_range+0x299/0x790 fs/coredump.c:915 elf_core_dump+0x2700/0x3900 fs/binfmt_elf.c:2142 do_coredump+0x2c97/0x3fc0 fs/coredump.c:764 get_signal+0x2434/0x2790 kernel/signal.c:2890 arch_do_signal_or_restart+0x90/0x7f0 arch/x86/kernel/signal.c:309 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:309 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0x7f43c527caf1 Code: c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f RSP: 002b:0000000000000050 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f43c539bf80 RCX: 00007f43c527cae9 RDX: 0000000000000000 RSI: 0000000000000050 RDI: 00000000810a0000 RBP: 00007f43c52c847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 000000000000000b R14: 00007f43c539bf80 R15: 00007fff153d0988 The buggy address belongs to stack of task syz-executor.0/5251 and is located at offset 108 in frame: dump_user_range+0x0/0x790 fs/coredump.c:482 This frame has 3 objects: [48, 56) 'pos' [80, 96) 'bvec' [112, 152) 'iter' The buggy address belongs to the virtual mapping at [ffffc90004d88000, ffffc90004d91000) created by: kernel_clone+0xfd/0x920 kernel/fork.c:2902 The buggy address belongs to the physical page: page:ffffea0001e79c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79e70 memcg:ffff88801d6a9282 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88801d6a9282 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 59, tgid 59 (kworker/u4:4), ts 334176444349, free_ts 334174187687 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1534 prep_new_page mm/page_alloc.c:1541 [inline] get_page_from_freelist+0x98f/0x32a0 mm/page_alloc.c:3333 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4589 alloc_pages+0x1a9/0x270 mm/mempolicy.c:2304 vm_area_alloc_pages mm/vmalloc.c:3063 [inline] __vmalloc_area_node mm/vmalloc.c:3139 [inline] __vmalloc_node_range+0x8f3/0x1bf0 mm/vmalloc.c:3320 alloc_thread_stack_node kernel/fork.c:309 [inline] dup_task_struct kernel/fork.c:1118 [inline] copy_process+0x13e3/0x74b0 kernel/fork.c:2327 kernel_clone+0xfd/0x920 kernel/fork.c:2902 user_mode_thread+0xb4/0xf0 kernel/fork.c:2980 call_usermodehelper_exec_sync kernel/umh.c:133 [inline] call_usermodehelper_exec_work+0x6b/0x170 kernel/umh.c:164 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630 process_scheduled_works kernel/workqueue.c:2703 [inline] worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1134 [inline] free_unref_page_prepare+0x476/0xa40 mm/page_alloc.c:2383 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2518 qlink_free mm/kasan/quarantine.c:166 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:762 [inline] slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x195/0x330 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1003 [inline] __kmalloc+0x4f/0x100 mm/slab_common.c:1017 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:721 [inline] fib6_info_alloc+0x40/0x160 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x337/0x1e70 net/ipv6/route.c:3749 ip6_route_add+0x26/0x150 net/ipv6/route.c:3843 addrconf_add_mroute+0x1d9/0x340 net/ipv6/addrconf.c:2498 addrconf_add_dev+0x150/0x1c0 net/ipv6/addrconf.c:2516 addrconf_dev_config net/ipv6/addrconf.c:3419 [inline] addrconf_init_auto_addrs+0x380/0x810 net/ipv6/addrconf.c:3506 addrconf_notify+0x70f/0x1920 net/ipv6/addrconf.c:3679 notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93 call_netdevice_notifiers_info+0xb9/0x130 net/core/dev.c:1970 Memory state around the buggy address: ffffc90004d8f480: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90004d8f500: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 f2 f2 f2 00 >ffffc90004d8f580: 00 f2 f2 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 ^ ffffc90004d8f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90004d8f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================